CERT24CVE-2026-114645 — Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrappingLoading data…
CERT24Threat Observatory
Period

CVE-2026-114645 — Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

A 32-bit integer wraparound in the MongoDB C Driver’s Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client’s connection configuration. An out-of-bounds write may corrupt client-process memory and cause denial of service in the client application. Only client builds compiled with the Windows-native authentication backend are affected.

← Back to intelligence

CVE-2026-114645 — Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

A 32-bit integer wraparound in the MongoDB C Driver’s Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client’s connection configuration. An out-of-bounds write may corrupt client-process memory and cause denial of service in the client application. Only client builds compiled with the Windows-native authentication backend are affected.